# Guardrails for PII and prompt injection, and approvals URL: https://www.getdynamiq.ai/product/guardrails > Screen input for PII and prompt injection before it reaches a model, and pause any tool step for a reviewer who can edit the fields before it runs. Detect PII and prompt injection before a model sees them, enforce content policies, and pause tool steps for a person to approve. [Start free](https://app.getdynamiq.ai/signup) · [Talk to the team](https://www.getdynamiq.ai/book-a-demo) _Illustration of guardrail events: a social security number detected in a customer message and blocked, and a prompt injection detected in a retrieved web page and quarantined._ In short Guardrails are workflow nodes that detect PII, prompt injection and policy violations before an agent acts on them, and validators that check an output's shape afterward. Approvals pause a tool call or an agent plan for a person to review, with fields they can edit before it runs. Detectors flag; they do not rewrite or redact what they find, so every decision about a flagged message is yours to make. ## What Guardrails and approvals does Detect PII Flag names, emails, addresses and account numbers in a message before it reaches a model or leaves your boundary in a prompt. Detect prompt injection Classify whether a message is trying to override your system prompt, so you can branch it away from the agent. Content policy checks Screen a message against content-safety policies and see exactly which category it violated, so you can route it deliberately. Approvals with editable fields Pause a tool node until a reviewer signs off, and let them edit the exact fields that are about to run, not just approve blindly. Execution approval on any tool Gate the one step that touches the outside world, sending an email, writing to a database, calling a payment API, without slowing down everything else. Every verdict traced Every detector result and every approval decision is recorded in the run's trace, so a flagged input is reviewable after the fact. ## Detect before a model ever sees it Three detectors screen free-form text before it reaches an agent: a PII detector flags personal information such as names, emails and account numbers; a prompt injection detector classifies whether a message is trying to override your system prompt; and a policy detector checks a message against content-safety categories and reports which ones it violated. Each one returns a flag you branch on with a Choice node, routing a clean message to the agent and a flagged one to a refusal, a rewrite step you own, or a person. - Detectors are classifiers, not redactors: they tell you what was found, they do not rewrite the message - Chain a prompt injection check and a PII check before the same agent for defense in depth - Every detector verdict is recorded in the run's trace alongside the message it scored _Illustration of detector results on one message: the PII detector found an account number and an email address, and the prompt injection detector found nothing._ ## Approvals a person can edit Execution approval pauses a tool node every time it is about to run, not just when the agent decides to ask. Turn it on for the one step that matters, an email send, a database write, a payment call, and the run emits an approval request with a rendered message showing exactly what is about to happen. A reviewer can approve as is, edit any field you marked mutable before approving, such as the body of an email, or reject with feedback the agent reads as its next observation and can act on. - Orchestrator nodes have the same gate for a task plan, so a person approves the plan before any task runs - A paused run is checkpointed, so a reply minutes or days later resumes it from where it stopped - The Human Feedback tool covers the other direction: the agent asks a person a clarifying question mid-run _Illustration of an execution approval: before the agent updates the loan system, a reviewer sees the exact call, edits the amount, rate and conditions it may change, and approves or rejects with a reason._ ## Guard the step that matters Guardrails compose. Put a detector in front of an agent, a validator behind it checking the output is well-formed JSON or matches a required pattern, and an approval gate on the one tool that actually changes something outside the workflow. A validator can either return a valid flag you branch on, or fail the node outright and trigger its retry policy, giving a model one more attempt to produce well-formed output before the run fails. - Valid JSON, Valid Python, Valid Choices and Regex Match cover the common output contracts - A rejected approval is not a dead end; its feedback flows back into the agent's next step - Route a flagged branch to a person instead of a static refusal for genuinely ambiguous cases _Illustration of composed guardrails: a PII detector before the agent, a JSON validator after it and an execution approval on the step that changes a system._ ## Detectors and validators - PII detector - Prompt injection detector - Policy detector - Valid JSON - Valid Python - Valid choices - Regex match ## Where teams use it - [AI agent governance · Screen what reaches the model, approve what the agent does, and keep a replayable record of every run, with the same controls on every agent.](https://www.getdynamiq.ai/use-cases/ai-agent-governance) - [Compliance and financial crime · Triage KYC and AML alerts, monitor regulatory change, and draft reports, with every decision routed to an analyst for sign-off.](https://www.getdynamiq.ai/use-cases/compliance-financial-crime) - [KYC and customer onboarding · Read onboarding documents, gather screening results, apply your risk rules and prepare the file, with an analyst approving every new account.](https://www.getdynamiq.ai/use-cases/kyc-onboarding) ## Works with - [Agent Builder · Design an agent on a visual canvas or in the open-source Python SDK. Both compile to the same engine, so what you build ships either way.](https://www.getdynamiq.ai/product/agents) - [Apps and deployments · Deploy a saved workflow version as an App with its own hostname. Call it over HTTP, embed a chat widget, or trigger it on a schedule or an event.](https://www.getdynamiq.ai/product/deployments) - [Observability · Every run is traced and replayable, node by node, with the cost, latency and tokens each step used.](https://www.getdynamiq.ai/product/observability) ## Documentation - [Guardrails and validators](https://docs.getdynamiq.ai/docs/platform/workflows/advanced/guardrails-and-validators) - [Human in the loop](https://docs.getdynamiq.ai/docs/platform/workflows/advanced/human-in-the-loop) - [PII detector](https://docs.getdynamiq.ai/docs/platform/nodes/validators/pii-detector) - [Prompt injection detector](https://docs.getdynamiq.ai/docs/platform/nodes/validators/prompt-injection-detector) ## Questions and answers ### Does Dynamiq redact PII automatically? No. The PII detector tells you that personal information was found and what kind, so you can route the message away from a model or to a person; it does not rewrite or redact the message itself. ### What is the difference between a detector and an approval? A detector classifies a message, PII, prompt injection or a policy violation, so you can branch on the result. An approval pauses a specific step every time it is about to run and waits for a person to sign off, independent of what any detector found. ### Can a reviewer change what an approved step actually does? Yes, for fields you mark as mutable on that node. A reviewer can edit those values before approving, so what runs is what they confirmed, not just what the agent drafted. ### What happens if an approval is rejected? The node does not run, and the reviewer's feedback flows back into the workflow. An agent sees it as its next observation and can revise its plan instead of the run simply failing. ### Can I require approval on every tool call? You can, but it is usually more useful to gate the one step that touches the outside world, an email, a database write, a payment call, and let the agent plan and draft freely up to that point. ## See an agent on your own workflow. Bring a process and its documents. Our engineers will show you how Dynamiq runs it, in your environment or ours. [Start free](https://app.getdynamiq.ai/signup) · [Talk to the team](https://www.getdynamiq.ai/book-a-demo)